CVE-2026-45580: WWBN AVideo Stored XSS in Live Plugin Stream Key

Technical summary

The Live plugin in WWBN AVideo 29.0 and earlier fails to sanitize the stream key before rendering it into an HTML class attribute in the 'YouTube-style' view. An authenticated user with canStream privileges can manipulate the stream key via plugin/Live/saveLive.php to include a quote character followed by an event handler (e.g., " onload="..."). When the live stream page loads, the injected event handler executes in the context of the platform's origin, allowing theft of session cookies, credential harvesting, or malware injection. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Business impact

This vulnerability poses a risk to platform availability and user trust. An attacker with streaming permissions can compromise any visitor to the platform, including administrators. Potential impacts include unauthorized access to user accounts, theft of sensitive data, defacement of the platform, or deployment of malware to users' machines. For organizations running AVideo as a shared or public service, this enables lateral movement within the user base and may violate compliance requirements around data protection and incident reporting.

Affected systems

WWBN AVideo version 29.0 and all earlier versions are affected. The vulnerability is isolated to the Live plugin's YouTube-style view rendering. Systems running patched versions or those that have disabled the Live plugin are not affected. Verify your current AVideo version in the admin dashboard.

Exploitability

Exploitation requires a user account with canStream privileges—typically a content creator or administrator role. The attacker then modifies the stream key through the saveLive.php endpoint. No network-level access, authentication bypass, or user interaction beyond viewing the stream is required for the injected script to execute. The low attack complexity and reliance on relatively common permissions make this moderately exploitable in multi-user environments.

Remediation

Upgrade WWBN AVideo to a patched version that sanitizes stream key output using htmlspecialchars() or equivalent context-aware encoding before rendering into HTML attributes. Until patching is possible, restrict canStream permissions to trusted users only, and consider disabling the YouTube-style view or the Live plugin entirely if not actively used. Implement Content Security Policy headers to mitigate XSS impact.

Patch guidance

Check the official WWBN AVideo repository and security advisories for patched versions released after 2026-06-17. Apply the update to the platform codebase, verify the Live plugin's rendering code includes proper HTML entity encoding for user-controlled attributes, and test the live stream view with sample stream keys containing special characters. Restart the AVideo service after deployment.

Detection guidance

Monitor web server and application logs for POST requests to plugin/Live/saveLive.php containing quote characters, angle brackets, or event handler keywords (onload, onerror, onclick) in the stream key parameter. Use a Web Application Firewall (WAF) to block payloads matching XSS patterns in the Live plugin endpoints. Periodically audit configured stream keys in the database for suspicious characters or event handlers. Check browser console logs on user machines for unexpected script execution during live stream viewing.

Why prioritize this

Although rated MEDIUM severity (CVSS 5.4), this vulnerability should be prioritized because it affects all platform visitors regardless of role, can escalate attacker access through credential theft, and exploits a common user action (viewing a live stream). The requirement for low-level streaming privileges means many organizations may have affected users. Patching is straightforward and should be scheduled promptly.

Risk score, explained

The CVSS 3.1 score of 5.4 (MEDIUM) reflects: low attack complexity and no special privileges required for exploitation beyond basic streaming rights; network-accessible vector; limited direct confidentiality and integrity impact to individual sessions; and no denial-of-service capability. However, the scope is changed (cross-site), and the platform-wide reach elevates practical risk above the numeric score in multi-user deployments.

Frequently asked questions